Last updated: October 2026
System monitors sit in an awkward grey area. The same kind of software that lets a school protect pupils on school laptops, or a company keep patient data off personal USB drives, can also be sold as a hidden spying tool that records every key a person types. The technology is similar. The consent, the visibility, and the purpose are what separate the two.
This guide explains what system monitors are, what they can record, and where legitimate monitoring ends and spyware begins. It then covers the signs that a device is being monitored, how to check and remove unwanted monitoring on a device you own, and the legal framing for employer devices, where the rules are different and removing software yourself can be the wrong move.
What Are System Monitors?
A system monitor is software that observes and records activity on a computer, phone, or tablet. Depending on the product, it can log which apps are opened, which websites are visited, what is typed, when the device is used, and where it is. The records are stored on the device or sent to a dashboard that the person who installed the software can review.
System monitors are a form of monitoring software, and the powerful end of the category overlaps with spyware. Our full explainer on what spyware is and how it spreads shows how the same recording features appear in openly malicious tools. The difference is rarely the feature list. It is whether the person using the device knows the monitoring is there, agreed to it, and can see what is collected.
Legitimate Uses of System Monitors
Monitoring is not automatically spying. There are settings where it is normal, disclosed, and often legally required.
- Workplace IT and security: Employers use endpoint monitoring to spot malware, stop data leaks, keep software licences in order, and investigate genuine security incidents on company devices.
- Schools: School issued laptops and tablets are commonly monitored to filter harmful content and protect children, under policies shared with parents.
- Parental controls, used openly: Parents may monitor a young child’s own device for safety. Responsible use is age appropriate, discussed with the child as they grow, and scaled back over time.
- Your own devices: Activity logs, screen time reports, and find my device tools are system monitors you run on yourself, and they are useful for security and for understanding your own habits.
Notice the pattern. In every legitimate case, the monitoring is disclosed in a policy or a conversation, it is proportionate to a real need, and it runs on a device owned by the person or organisation doing the monitoring.
When Monitoring Becomes Spyware
Monitoring crosses the line when secrecy becomes the point. Warning signs in how a tool is marketed and used include a hidden app icon, instructions to disable antivirus software, a stealth mode designed so the device user never finds out, and marketing aimed at reading a partner’s messages without their knowledge.
Software installed secretly on a device that belongs to someone else, collecting their messages, passwords, or location for a private individual, is spyware in practice whatever the sales page calls it. In many places it is also illegal to install, and the companies behind consumer spyware have repeatedly suffered data breaches that exposed the very people they recorded. If a product needs to hide from the person being watched, that tells you most of what you need to know.
What System Monitors Can Record
Capabilities vary by product and by how much access the installer had, but common features include:
- Keystrokes: Everything typed, including messages, searches, and sometimes passwords, which is why keyloggers are the most feared type.
- Screenshots and screen recordings taken at intervals or when certain apps open.
- App and web activity: Which apps were used, for how long, and which sites were visited, even in private browsing windows in some cases.
- Messages and calls: On phones especially, logs of calls and, where permissions allow, the content of messages.
- Location: GPS history and live position on mobile devices.
- Files and photos: Copies of documents, downloads, and images, or alerts when files are moved.
On phones, the same features appear under a different label. Our guide to mobile spyware and how to protect against it breaks down the phone specific versions, and our walkthrough on how to detect spyware on an iPhone covers the checks iPhone owners can actually run.
Signs Your Device May Be Monitored
Good monitoring tools are designed to be quiet, but few are perfectly invisible. Look for a pattern of changes, particularly any that began suddenly.
- Battery drain, data use, or heat rises sharply with no change in your own habits.
- Unknown apps, browser extensions, or background processes you do not recognise.
- Your security software flags a monitoring tool, or its real time protection keeps turning off.
- Settings change on their own, such as permissions granted to an app you barely use.
- The device behaves oddly: the screen wakes by itself, calls have strange background sounds, or restarts take much longer than before.
- Someone knows details from messages or emails they should never have seen. Treat this as a serious signal, not a coincidence.
How to Check a Device You Own
Work through the checks for your platform. They take minutes and need no special tools.
- Review installed apps and programs. On Windows, check Settings, then Apps. On a Mac, review the Applications folder. On phones, scroll the full app list, not just the home screen, and remove or investigate anything you do not recognise.
- Check running processes. Task Manager on Windows and Activity Monitor on a Mac show what is running now. A process using steady CPU or network in the background, with no clear owner, is worth searching by name.
- Look for management profiles. On an iPhone, open Settings, General, then VPN and Device Management. A profile you did not install, or that you do not expect from work or school, can control and monitor the device. On Windows, Settings, Accounts, then Access work or school shows enrolled organisations. On Android, check device admin apps in the security settings.
- Check startup items and browser extensions. Monitors need to restart with the device. Review login items, startup apps, and every browser extension, and remove what you cannot account for.
- Run a full security scan. Use updated, reputable antimalware software and run its deepest scan. Many consumer spyware and stalkerware tools are now detected by name.
How to Remove Unwanted Monitoring
On a device that is yours, removal is straightforward. Uninstall the unknown app or program, remove any management profile you did not add, restart, and scan again. If the tool returns, or you cannot find it but the signs continue, the reliable fix is to back up your photos and documents only, factory reset the device, and reinstall apps from official stores one at a time. Change your important passwords from a different, clean device afterwards, starting with email and banking, and turn on multi-factor authentication. Secretly installed monitors often arrive disguised inside another download, so the delivery habits in our trojan malware guide are worth reading before you reinstall anything.
One important exception. If the device belongs to your employer or school, do not remove its management or monitoring software yourself, even if you find it. That software is usually there under policy, removing it can break security rules or your employment terms, and the organisation will simply notice. The right route is to read the policy, use your own phone for personal matters, and raise concerns with IT or HR.
If you believe a partner or someone close to you installed a monitor, think about safety first. Removing it can alert that person, so consider getting advice from a trusted support organisation or a legal professional before you act, and use a device they cannot access for sensitive searches and calls.
Employer Devices: The Legal Framing
This is general information, not legal advice, and rules vary by country and state. On devices an employer owns, employers generally have wide rights to monitor activity, especially where staff have been told in a contract, handbook, or acceptable use policy, and where monitoring is tied to security or legal duties. Courts in the United States have usually given employers broad room on their own equipment, while European rules expect notice, a clear purpose, and proportionality under privacy and employment law.
The practical takeaways hold almost everywhere. Assume a work device can be reviewed. Keep personal banking, health, and private messages on your own phone. Personal devices brought under a bring your own device scheme should only be managed within the limits you agreed to, so read that agreement before enrolling. And covert monitoring of a purely personal device, by an employer or anyone else, is a very different matter that regulators and courts view harshly.
Protecting Your Own Devices
- Lock everything. A strong device passcode and biometric lock stop the brief physical access most secret installs need.
- Keep software updated. Updates close the holes that monitoring tools and other malware rely on.
- Guard your accounts. Unique passwords and multi-factor authentication limit the damage if one login leaks. A quick check with our browser leaks guide shows how much your browser reveals about you by default.
- Choose a safer browser. Our roundup of the most secure browsers covers options that reduce tracking and block hostile sites.
- Repeat the checks now and then. A two minute review of apps, profiles, and extensions every few months catches most problems early.
Final Thoughts
System monitors are tools, and tools take their character from how they are used. Disclosed, proportionate monitoring on a device owned by the organisation or parent responsible for it is one thing. The same features hidden on someone else’s personal device are spyware, with real legal and human costs.
Know the signs, run the simple checks for your platform, and keep clean boundaries between work and personal devices. If something on your own device should not be there, remove it, reset if you must, and secure your accounts. That routine handles the great majority of cases without drama.
